Support FAQ

If you’ve ever worked with network security, you’ve probably encountered Network Address Translation (NAT) at some point. It’s one of those fundamental networking concepts that keeps the internet running smoothly. But why should you use NAT specifically on Palo Alto Networks ‘firewalls? Let’s break it down in a way that makes sense, especially if you're managing security policies and network architecture.

This guide covers SSL Forward Proxy and SSL Inbound Inspection. We will discuss and provide resources on why you might need these configurations, suitable implementation scenarios, and practical strategies for planning, configuring, and troubleshooting your deployment.    Do You Need SSL Decryption?   Not every environment requires SSL decryption, but there is a good chance you do. Start by assessing whether your organization faces threats hidden in encrypted traffic or compliance requirements requiring traffic inspection. Common indicators that you might need SSL decryption include: High volumes of encrypted traffic that lack visibility (Head over to your firewalls’ ACC tab, do you find SSL being one of your top-used applications?) Concerns about threats like malware or data exfiltration within encrypted channels. Compliance requirements for data inspection or monitoring. For insights on making this decision, check out PANcast Episode 9: Should You Have SSL Decryption Enabled?   Understanding SSL Decryption Types   SSL Forward Proxy: Used for outbound traffic from internal users to external servers. The firewall intercepts encrypted sessions, decrypts them for inspection, and re-encrypts them before forwarding to the destination. Ideal for preventing data exfiltration and inspecting malicious content in outgoing traffic. SSL Inbound Inspection: Applied to inbound traffic targeting internal servers. The firewall uses the server’s private key to decrypt incoming sessions, inspect the content, and re-encrypt it for delivery. Suitable for protecting web applications and servers that you host from encrypted attacks. For more details read through the Decryption Overview.   Planning for SSL Decryption   Effective deployment requires careful planning to minimize performance impact and comply with privacy laws. Key considerations include: Defining Your Scope: Decide which traffic to decrypt based on your organizational needs and compliance requirements. Capacity Planning: Ensure your firewall can handle the processing demands of SSL decryption. Privacy Compliance: Exclude sensitive traffic, such as financial or healthcare data, to avoid violating regulations. For a comprehensive planning guide visit, Plan Your SSL Decryption Best Practice Deployment.   Configuration Steps   Prepare Your Environment: Install and configure certificates for SSL Forward Proxy or Inbound Inspection. Define decryption profiles to specify allowed and blocked traffic. Create Policies: Set up decryption policies to identify traffic for inspection. Configure exclusions for sensitive or exempted traffic (e.g., banking or healthcare). Apply Decryption Profiles: Associate profiles with your decryption policies to enforce the desired behavior. Detailed configuration steps can be found through Configure SSL Forward Proxy and Configure SSL Inbound Inspection. Once decryption is configured, check out How Do I Know If Traffic is Hitting a Decryption Policy?   Best Practices   Start Small: Roll out decryption incrementally to specific traffic flows or user groups. Monitor Performance: Keep an eye on firewall resource utilization and session limits. Log and Analyze Traffic: Use logs to identify misconfigurations or traffic that doesn’t match policies. For additional guidance, refer to the Decryption Best Practices.   Additional Resources   SSL decryption is a powerful tool for enhancing visibility and securing your network against encrypted threats. Whether you’re just starting or optimizing an existing deployment, the resources linked in this guide can help you navigate the process effectively.   For further insights, see:   Resource List: SSL Decryption Configuring and Troubleshooting Troubleshoot and Monitor Decryption SSL Decryption Session is Full Inbound SSL Decryption for apache2 server

Are you seeking better control over your web traffic? This guide will walk you through the steps to create custom URL categories and integrate them into your security policies.

There are many reasons as to why Data Plane (DP) CPUs can be high, so addressing this behavior on Palo Alto Networks firewalls can be tricky. It’s best to use a comprehensive and methodical approach to handling DP CPUs.

Learn a methodical approach to troubleshooting IPSec VPN issues in this Support FAQ article.

LIVEcommunity's Support FAQ provide clear, comprehensive resources that address customers' most common issues. Here's what you need to know about Upgrading PAN-OS and Upgrade Paths.